Skip to main content
POST
Error

Authorizations

Authorization
string
header
required

Scoped API token from Settings → API Tokens (scopes: scans:trigger, scans:read).

Headers

CF-Access-Client-Id
string

Cloudflare Access service-token client id (ends in .access). Only for CF-Access-fronted deployments; leave blank for self-hosted.

CF-Access-Client-Secret
string

Cloudflare Access service-token secret. Pair it with CF-Access-Client-Id.

Body

application/json
githubFullName
string
required

owner/name of the GitHub repository.

Example:

"my-org/payments-api"

commitSha
string

Commit SHA (CI metadata for auto-discovery).

Example:

"a1b2c3d4"

branch
string

Branch name (CI metadata).

Example:

"main"

prNumber
integer

PR/MR number (CI metadata).

Example:

42

scanTypes
string[]

Scan tiers to run. Omit for the server default (SAST, SCA, SECRET, IAC for repositories). Valid values depend on target type.

Example:

Response

Scan queued.

The scan id is returned as scanJobId (aliased as id on some endpoints). repository is present only for from-github auto-discovery.

scanJobId
string
Example:

"cmrasmw4702sdstu9j4iq1x55"

id
string

Alias for scanJobId on some endpoints.

repository
object